Alter launches access control for multi-user AI agents

Alter sits in the request path between agents and third-party APIs. Alter says it stores credentials in a vault and injects them into proxied requests, so agent code does not hold the keys. Each agent gets its own identity and scopes, and a default-deny policy can be set down to the parameter level.

Sensitive calls can be routed to a named person for approval, and revoking an agent, key or grant takes effect immediately. Identity-provider webhooks can cascade offboarding. Every call is recorded in an audit trail that can be streamed to a SIEM, and the company cites 140 supported providers with LangChain, MCP and AWS integrations.

Alter says SOC 2 is in progress and that its trust center publishes monitored controls and a penetration test from within the last 12 months. It also says credentials are encrypted at rest in a dedicated secret store and that policy evaluation fails closed.

Teams selling agent products into enterprises can replace a single shared API key with per-agent identities and scoped grants, and hand reviewers an audit trail. Agent code can call providers without ever holding the raw credentials. Developers should still confirm that the proxy supports the specific APIs they use, and note that the SOC 2 audit is not yet complete.